PT-2026-35747

CVE-2026-41873

Published

2026-04-28

Updated

2026-05-26

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pony Mail (Lua implementation) (affected versions not specified)

Description Inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows for admin account takeover. This occurs when a front-end server and a back-end server disagree on the boundaries of an HTTP request, potentially allowing an attacker to "smuggle" a request to the back-end.

Recommendations Restrict access to the instance to trusted users. Find an alternative software solution.

Exploitability

Fix

Impacts

Researchers

Li Jiantao

Tevel Sho

Vendors

Affected products

Weakness enumeration

CWE-444: Inconsistent Interpretation of HTTP Requests (\'HTTP Request/Response Smuggling\')

Related identifiers